The vendor
conversation guide
26 questions to ask a human risk vendor before you sign anything. Built to show you how a vendor thinks, with notes on what a strong answer sounds like.
Most vendor calls run on the vendor's script. You get the demo, the logo slide, the AI slide, and a click-rate chart that trends down and to the right. Forty-five minutes later you know what the product does and almost nothing about how the company thinks.
These questions flip the script. They show you a vendor's judgment: where they think the space is going, what they refuse to build, where they keep a human in the loop, and which parts of their product they'd rather you didn't look at too closely.
How to use it. Pick the sections that matter to your program. Nobody needs all eleven in one sitting. Two or three topics, asked well, tell you more than a 200-row RFP spreadsheet.
Works for renewals, new evaluations, analyst-style briefings, and the intro call you agreed to at a conference. Print it and the page turns into a checklist with room for notes.
Where they're headed
- Where do you think this space is going in the next two years, and where does your product fit?
- What are you building toward that isn't on your website yet?
- What are you choosing not to build, and why?
Teams, both sides of it
- How are you thinking about Teams as an attack surface and as a place to run the program?
- What does a good Teams experience look like to you, for employees and for the people running it?
When the agent gets phished
- As employees start working with AI assistants and agents, how do you think about the risk that creates?
- What do you think the training and testing side of that looks like?
- Is that something you're building toward, and what's your sense of how customers are thinking about it?
Who's driving the program
- How are you thinking about agents helping run the program, such as building and analyzing campaigns?
- Where do you think a human should stay in the loop?
- How are you thinking about connecting with the AI tools customers already use?
Rehearsal, not a gotcha
- How are you thinking about tabletop and exercise support?
- Where do you see the line between simulating an attack on people and helping a team rehearse its response?
- Where do you think AI helps in running an exercise, and where doesn't it?
Whose voice is that
- How are you thinking about realistic voice and video in training, and where do you draw the line?
- How do you think about consent for the people being imitated?
How far it's allowed to go
- How are you thinking about attacks that adapt to the person across steps and channels?
- How much autonomy do you think is right, and who decides?
Life after click rates
- Beyond clicks, what do you think a good signal of human risk looks like in a few years?
- What data would you want to use, and what would you decline to collect?
Insight or surveillance
- How do you think about the line between useful insight and monitoring individuals?
- What scenarios do you think are off limits, and how do you decide?
Turn the lens around
- How are you thinking about the risk your own AI features add to a customer?
- Which parts of your AI would you want us to scrutinize first?
The first gig
- What would a good first engagement look like from your side?
- Who are the customers you'd want us to talk to?
Know your own gaps before they pitch you theirs
Vendor answers only mean something against your own baseline. If you don't know where your program stands on strategy, engagement, assessment and training, every pitch sounds like the fix you need. The free SEAT maturity assessment takes about 15 minutes, needs no account, and tells you which gaps you're trying to close.